ALSA: FCP: Use a private URB for the notification endpoint

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80816
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-04 16:18:09 UTC
Updated2026-09-04 16:18:09 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create() allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device with that endpoint, fcp_init_notify()'s "already set up" early return fires on the status URB and returns success without doing anything. No FCP notification URB is submitted, and cmd_done is left zeroed because it is initialised past that early return and nowhere else. fcp_init() then issues init1_opcode and wait_for_completion_timeout() would crash adding to the zeroed wait.head. fcp_cleanup_urb() would also kill and free mixer.c's status URB. Use a separate URB in fcp_data, and initialise cmd_done in fcp_init_private() where fcp_data is allocated. fcp_init_notify() is reached again after suspend via fcp_reinit(), and the URB kill path in fcp_notify() completes cmd_done, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinit_completion() to clear it.

Risk And Classification

EPSS: 0.001680000 probability, percentile 0.063050000 (date 2026-09-07)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 46757a3e7d50dac923888e7fbe68377736f13c70 65aceb45ca91ddb7f7ed178821f481b34da35543 git Not specified
CNA Linux Linux affected 46757a3e7d50dac923888e7fbe68377736f13c70 5da21a434171e8ecf1d992c6f1d84c0c706fd395 git Not specified
CNA Linux Linux affected 46757a3e7d50dac923888e7fbe68377736f13c70 6db3c1d7e2872c9904e05ca8e0515920776a3c9c git Not specified
CNA Linux Linux affected 46757a3e7d50dac923888e7fbe68377736f13c70 918b8d231c571c50a00efe92ffc8404a537a0490 git Not specified
CNA Linux Linux affected 6.14 Not specified
CNA Linux Linux unaffected 6.14 semver Not specified
CNA Linux Linux unaffected 6.18.47 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.11 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2.1 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/5da21a434171e8ecf1d992c6f1d84c0c706fd395 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/65aceb45ca91ddb7f7ed178821f481b34da35543 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/918b8d231c571c50a00efe92ffc8404a537a0490 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6db3c1d7e2872c9904e05ca8e0515920776a3c9c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report